From visitor ID to device identity: how a verdict is made

A visitor ID labels a browser session. A device identity recognizes the machine behind it, through cleared cookies and private windows. This post walks through how LR Defender gets from one to the other, and where the limits are.

Three calls

Every integration is one script tag and three calls:

1. Your server mints a short-lived session with your secret key.
2. The browser runs the SDK, which collects its signals, sends them to us, and gets back a request ID.
3. Your server fetches the verdict for that request ID, again with your secret key.

The order matters. The verdict you act on comes from our server, not from the browser, so a script that tampers with the page cannot hand your backend a clean answer. The quick start walks through each call.

What the SDK collects

The SDK collects more than 90 browser, hardware and runtime signals: how the graphics stack renders, how audio is processed, which fonts are present, what the screen and platform report, and whether the environment shows signs of automation. It does not collect names, email addresses, phone numbers, payment data or government IDs. It does process the IP address and the user-agent string, as every web request does.

One ID, derived on our servers

The device ID is derived on our servers from hardware and runtime signals, and it is scoped to your account: another customer sees a different ID for the same machine. It does not live in a cookie, so clearing cookies or site storage does not reset it, and a private window in the same browser gives the same ID. The IP address is not part of the ID, so a VPN does not change it.

Where recognition stops

Recognition holds across browsers that share an engine, such as Chrome and Edge. Matching across engines, for example from Chrome to Firefox, is in evaluation and off by default. Identical machines can look alike: two laptops of the same model with the same software can present the same signals. We say so because a buyer who assumes otherwise will find out on their own traffic.

Every check, every time

Each identification also runs the bot checks for headless browsers, WebDriver and automation frameworks. Network checks add a VPN, public proxy, datacenter and Tor verdict for the address, with its ASN, operator and location, and an allow, challenge or block action. Each network answer carries its reasons.

What we do not claim

We have not published an accuracy figure, because we have not measured one we would stand behind. A harness exists to measure it once labelled data is available. Until then, the fairest test is your own traffic, and each verdict carries the evidence to check it against.